Privacy Policy

1. Who we are

Let's Eat Ltd. (“Let's Eat”, “we”, “us”) is a company registered in the Cayman Islands, based in George Town, Grand Cayman. We operate the Let's Eat mobile app, the website at letseat.ky, and the food, grocery and retail delivery services behind them.

We are the data controller for the personal data described in this policy, and we handle it in accordance with the Cayman Islands Data Protection Act (2021 Revision) and, where it applies to you, other privacy laws such as the EU/UK GDPR.

Our restaurant and store partners are separate businesses. When they receive your order, they handle that information under their own policies for preparing it.

2. What we collect

We collect only what we need to take, deliver and support your order. Here it is, in full:

We do not collect health data, contacts from your phone, browsing history outside the app, biometric data, or anything about your race, religion, politics or sexuality.

3. How we use it

• Running the service — creating your account, showing what's available near you, taking payment, routing your order to the merchant and a driver, and letting you track it live.
• Talking to you about your order — confirmations, receipts, driver updates, and replies to support requests by push, SMS, email or in-app chat.
• Keeping things safe — verifying it's really you (OTP login), spotting fraud and payment abuse, and protecting drivers, merchants and customers.
• Making the app better — understanding which features are used, where people drop off, and what crashes, so we can fix and improve it.
• Eat+ rewards and offers — tracking your points and applying promotions you're eligible for.
• Marketing (only if you opt in) — occasional deals and news. You can turn this off in the app or with one tap on any message.
• Legal obligations — keeping financial records, responding to lawful requests, and enforcing our Terms of Service.

Our legal bases are: performing our contract with you, our legitimate interests in running a safe and reliable service, your consent where we ask for it (location, notifications, marketing), and compliance with the law.

4. Who we share it with

We never sell your personal data and we don't share it with data brokers or advertising networks. We share it only with the people and services needed to get your order to you:

All of these providers are bound by contracts that limit them to processing your data on our instructions. We may also disclose data where the law requires it, to protect someone's safety, or as part of a business sale or merger (in which case this policy continues to apply).

5. Payments

When you add a card, you type the details into a secure page hosted by Cayman Gateway, our PCI DSS–compliant processor. They give us back a token, the card brand, the last four digits and the expiry date — that is all we store. We cannot see or recover your full card number, and neither can our staff.

Your billing address is used to verify the card with your bank (AVS). Refunds are returned to the original card. You can remove a saved card at any time in the app.

6. Location data

The app asks for your precise location so it can show what delivers to you, estimate fees and times, and help drivers find you. We use it only while you are using the app — never in the background — and you can decline or revoke it at any time in your phone's settings. If you do, you can still order by typing an address.

Driver location is shared with you during a live delivery so you can track it. Drivers' positions are not shown to customers outside of an active order.

7. Notifications & messages

We send order-status pushes, SMS and emails because you've asked us to deliver something — these are transactional and can't be fully switched off while an order is live. Promotional messages are separate and optional; toggle them in Profile → Notifications or tap unsubscribe.

In-app chat with support or your driver is stored so we can resolve disputes and improve service. Please don't share card numbers or passwords in chat.

8. Cookies & analytics

letseat.ky uses essential cookies to keep you signed in and remember your cart. We use first-party analytics and crash reporting (Sentry) to see how the site and app perform. We do not use third-party advertising cookies, and we do not track you across other companies' apps or websites. The app does not request Apple's App Tracking Transparency permission because there is nothing to track.

You can clear or block cookies in your browser; the site will still work, but you'll need to sign in again.

Website audience reporting uses a random browser identifier stored for up to 30 days and a session identifier renewed after 30 minutes of inactivity. It records pages and product details opened, cart and checkout actions, search terms with contact-like text removed, search result counts, button and app-download clicks, page engagement and loading performance. We also record device category, referring website and campaign tags (utm_source, utm_medium and utm_campaign), without sending your name, contact details, payment details or other URL query strings. Clearing browser storage resets these identifiers. We also use Vercel Web Analytics for website traffic reporting. App activity reporting uses signed-in screen activity.

9. How long we keep it

• Account details — for as long as your account is open, then deleted within 30 days of a deletion request.
• Order and payment records — 7 years, as required for tax and accounting in the Cayman Islands. These are retained in a form that no longer links to a deleted account where possible.
• Location data — used in real time and retained only as part of the order's delivery record.
• Support chats — up to 2 years.
• Crash and analytics logs — up to 90 days.
• Marketing preferences — until you change them, plus a record that you unsubscribed so we honour it.

10. Security

All traffic between the app, website and our servers is encrypted (TLS). Data at rest is encrypted, access is role-based and logged, and we authenticate you with one-time codes rather than passwords. Card data never touches our systems. No system is perfectly secure, so if you think your account has been compromised, contact us straight away and we'll lock it down.

11. Your rights

Under the Cayman Islands Data Protection Act you have the right to:

To exercise any of these, email support@letseat.ky. We'll respond within 30 days and may ask you to verify your identity first. There is no charge unless a request is clearly excessive.

If you're not happy with how we've handled your data, you can complain to the Office of the Ombudsman, Cayman Islands, which oversees data protection here.

12. Children

Let's Eat is for people aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe a minor has created an account, tell us and we'll delete it.

13. International transfers

Some of the providers listed above store data outside the Cayman Islands (for example in the United States or the EU). Where that happens we rely on contractual safeguards that require them to protect your data to a standard equivalent to Cayman law.

14. Changes to this policy

We'll update this page when our practices change and update the date at the top. If a change is significant — for example a new category of data or a new type of sharing — we'll tell you in the app or by email before it takes effect.

15. Contact us